Foundations of the safety case .1 The disposal system

The disposal system is defined as the chosen repository design and its geological setting. The disposal system in the case of the proposed SF / HLW / ILW repository in the Opalinus Clay of the Zürcher Weinland, including a number of design options, is described in Chapter 4. The repository design is developed iteratively in the course of repository planning and development.

In particular, earlier studies indicate ways in which the robustness of the disposal system can be enhanced by modifications that avoid, reduce, or mitigate the effects of particular detrimental FEPs and uncertainties.

3.6.2 The system concept

The system concept is a description of what is known about the disposal system and its evolution, developed for the purpose of safety assessment. It includes a description of the key features of the system, as well as events and processes that may affect its evolution (features, events and processes are collectively referred to as FEPs), and broad conceptualisations of the possible paths that its evolution might take. It also includes a description of uncertainties. The system concept for the proposed SF / HLW / ILW repository is presented in Chapters 4 and 5.

49 NAGRA NTB 02-05

3.6.3 The safety concept

The safety concept is the conceptual understanding of why the disposal system is safe. The disposal system performs the broad safety functions described in Section 2.6 via a range of features and associated processes that vary in their effectiveness and in the level of understanding that is available. The safety concept is built on a limited number of effective and well-understood features that ensure that the disposal system is safe and that safety can be demonstrated, even allowing for the various uncertainties and detrimental events and processes that might affect its evolution. A safety concept is developed initially based on the relevant scientific understanding and the intended functions of the design, i.e. to fulfil the safety functions described in Section 2.6. During the safety assessment, estimates of performance are made and an understanding is developed of which elements of the disposal system actually provide safety under various conditions, thus refining the safety concept. The refined safety concept for the proposed SF / HLW / ILW repository is described in Chapter 6, which also identifies the most effective and well-understood features which are termed "pillars of safety".

3.6.4 Identification of assessment cases

An assessment case is a specific set of assumptions regarding the broad evolution of the repository and its environment, the conceptualisation of individual FEPs relevant to the fate of radionuclides within the disposal system and the parameters used to describe these FEPs. In the present safety assessment, a broad range of assessment cases is defined and analysed in order to illustrate the impact of various detrimental FEPs and uncertainties on the level of safety provided by the disposal system. This range of cases has to be representative of all realistically conceivable possibilities for the characteristics and the evolution of the system. The identifi-cation of assessment cases and the underlying reasoning is documented in Chapter 6. The cases and the results of their analysis are described in Chapter 7.

3.6.5 Arguments and analyses

The safety case includes more information than numerical values of calculated dose or risk (see also the discussion of assessment principles in Section 2.6). The arguments and analyses that constitute the safety case for the proposed SF / HLW / ILW repository are brought together in Chapter 8, where the following broad lines of argument are followed.

• The strength of geological disposal as a waste management option – Arguments are made that safe geological disposal is possible provided a suitable site and design are chosen, and the positive attributes of geological disposal as a long-term waste management option are discussed.

• The safety and robustness of the chosen disposal system – The level of safety provided by the chosen system is illustrated and arguments are made that support the robustness of the chosen system. These mainly qualitative arguments, which complement the quantitative analyses, draw on evidence from nature, engineering experience, and laboratory and field experiments.

• The reduced likelihood and consequences of human intrusion – Arguments are made that the likelihood of human intrusion is small for the chosen site, and that, if human intru-sion were to occur, the consequences would be minimised by the chosen design of the repository.

• The strength of the stepwise repository implementation process – Arguments are made in support of the stepwise repository implementation process as far as these are related to the safety case. A key characteristic of the stepwise process is the periodic assessment of the

NAGRA NTB 02-05 50

project. This explicitly includes the possibility for modifications. This means that in the earlier phases of the project assessments need to be made based on preliminary information and the quality of the assessment will depend upon the reliability of this information base. If it is possible to rely for safety on well understood and well characterised repository components already in the early phases, this means that a robust safety case can be made even at such an early stage of the programme. Thus, although it is acknowledged that for a licence application the current information base needs to be extended, it is argued that the current information base is adequate to provide enough confidence that there are no critical deficiencies that could undermine the safety case.

Another argument in support of the stepwise repository implementation process is that it favours the identification and subsequent consideration of previously unrecognised safety-relevant issues. This is (i) because of the involvement of all stakeholders at each step (who may point out such issues) and (ii) because, via monitoring, possible perturbing factors are likely to be detected. That such factors can be adequately addressed is ensured by flexibility in the design and the possibility for modifications.

The operational phase, the observation phase and the post-closure phase together cover a rather long period of time and require careful consideration of security and safeguards measures as these are also essential for safety. The arguments related to this issue are not, however, developed in detail given the current early stage of the programme.

• The good scientific understanding that is available and relevant to the chosen disposal system and its evolution – Arguments are made that the available system understanding and characterisation provide a strong scientific foundation for carrying out the safety assessment.

• The adequacy of the methodology and the models, codes and databases that are available to assess radiological consequences – Arguments are made that the methodo-logy is clearly defined, has been properly applied and can provide a safety case that is trans-parent, traceable, complete and robust, in accordance with the assessment principles. Argu-ments are also made that the models, codes and databases used to analyse the assessment cases are well supported, and have been properly applied.

• Multiple arguments for safety – Several lines of argument are used to discuss the level of safety provided by the disposal system. These are compliance with regulatory safety criteria, comparison with complementary safety indicators, the existence of reserve FEPs and the lack of outstanding issues with the potential to compromise safety. These are briefly discussed below.

Compliance with safety criteria: Analyses are carried out that test whether the safety criteria defined in HSK-R-21 (HSK & KSA 1993) are fulfilled for the range of representa-tive assessment cases. The cases are defined in such a way as to illustrate a broad range of possibilities for the characteristics and evolution of the disposal system, taking into account the various sources of scenario, conceptual and parameter uncertainty.

Complementary safety and performance indicators: In order to place the results of the analyses in a broader perspective, comparison is made not only with dose criteria, but also with other safety indicators (IAEA 1994b, 2002b).

In the current safety case the following safety and performance indicators are used (see also Appendix 3):

– annual dose received by an average individual in the population group likely to be most affected by the potential releases from the repository, as a function of time, which is compared with Protection Objective 1 specified in HSK-R-21,

51 NAGRA NTB 02-05

– individual radiological risk as defined in Protection Objective 2 of HSK-R-21 is used in the graphical representations of results from the probabilistic safety analysis (Chapter 7),

– the radiotoxicity of the wastes, which is evaluated as a function of time and compared with that of naturally occurring mineral deposits and rocks,

– radiotoxicity fluxes due to radionuclides released from the repository in the course of time, which are compared with natural radiotoxicity fluxes in the surface environment,

– radiotoxicity concentrations originating from the repository at the top of the Opalinus Clay, as a function of time, compared with natural radiotoxicity concentrations in Opalinus Clay, and

– the inventories of radionuclides in different components of the repository system, which are evaluated as functions of time, illustrating the fate of radionuclides and, in parti-cular, the degree to which they decay before reaching the surface environment.

Reserve FEPs: Some FEPs that are considered likely to occur and to be beneficial to safety are deliberately excluded from the assessment cases, or at least from their analysis, when the level of scientific understanding is insufficient to support quantitative modelling, or when suitable models, codes or databases are unavailable. Such FEPs are termed reserve FEPs, since they may be mobilised at a later stage of repository planning if the level of scientific understanding is sufficiently enhanced, and the necessary models, codes and databases are developed. The existence of reserve FEPs constitutes an additional, qualitative argument for reserves of safety beyond those indicated by the quantitative analysis.

In addition to the reserve FEPs, in some assessment cases there are further reserves due to a number of simplifying pessimistic or conservative assumptions that have to be made for the quantitative analysis because of the limitations of available codes and / or data.

Lack of outstanding issues with the potential to compromise safety: The safety analysis allows the identification of those phenomena that are key to the safety of the chosen system.

An evaluation of current understanding of these phenomena has to show that they are sufficiently well understood and adequately reflected in the safety assessment and that there are no outstanding issues that might undermine the safety case.

NAGRA NTB 02-05 52

3.7 Constructing the safety case